Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence

CVE-2018-7602

CriticalExploitedPublic exploit

Drupal Core Remote Code Execution Vulnerability

Published Apr 23, 2024 · Updated Oct 4, 2026 · Also known as DEBIAN-CVE-2018-7602, DLA-1365-1, DRUPAL-CORE-2018-004, DSA-4180-1, GHSA-297x-j9pm-xjgg, UBUNTU-CVE-2018-7602

Key Facts

Patch immediately
  • CVE-2018-7602 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Drupal, Debian Linux, drupal7 (alpine) and 3 more products.
  • It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Jul 19, 2018 and is known to be used in ransomware campaigns. Public exploit code is available.
  • EPSS estimates a 99% probability of exploitation in the next 30 days.
  • Fixed versions are available, including core 7.59, core 8.4.8, core 8.5.3.
  • Brandefense priority: patch immediately, because it is listed as exploited in the wild.

CVSS v3.1

9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (30-day exploit likelihood)

99%

Higher than 99.9% of all scored CVEs

Exploited in the wild

Yes

4 catalog listings, used by ransomware

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2018-7602 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.

Known-Exploited Catalog Listings

CatalogAddedRemediation dueRansomware use
CISA KEVApr 13, 2022May 4, 2022Known
Industry KEV feedJul 19, 2018May 4, 2022Known
CIRCL KEVApr 13, 2022May 4, 2022Known
ENISA EUVDApr 13, 2022n/aNot reported

Required action: Apply updates per vendor instructions.

Affected Products

28 affected entries in total
ProductAffected versionsFixed in
DrupalDrupalSee advisory7.59
Debian LinuxDebian7.0, 8.0, 9.0n/a
drupal7alpineSee advisory7.59-r0
drupal/corecomposer>= 8.58.5.3
drupal/drupalcomposer>= 8.58.5.3
1 more affected products in the full CVE brief

Patched Releases

core

7.59, 8.4.8, 8.5.3

Drupal

8.5.3-1, 7.59, 8.4.8, 8.5.3

drupal/core

7.59, 8.4.8, 8.5.3

drupal/drupal

7.59, 8.4.8, 8.5.3

drupal7

7.14-2+deb7u19, 7.26-1ubuntu0.1+esm1, 7.32-1+deb8u12, 7.44-1ubuntu1~16.04.0+esm1, 7.52-2+deb9u4, 7.59-r0

Timeline

  1. Added to Industry KEV feed

    Jul 19, 2018

  2. Added to CISA KEV

    Apr 13, 2022

  3. Added to CIRCL KEV

    Apr 13, 2022

  4. Added to ENISA EUVD

    Apr 13, 2022

  5. Publicly disclosed

    Apr 23, 2024

  6. Last updated

    Oct 4, 2026

Weakness Type

  • CWE-94 Improper Control of Generation of Code ('Code Injection')

References

15 more references in the full CVE brief

FAQ

Common Questions.

Is CVE-2018-7602 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.

Request A Demo